Skip to content

sctp: fix a vtag verification failure caused by stale INITs

Xin Long linux-sctp netdev netfilter-devel 2 versions – Applied

Status from this message: This series was applied to netdev/net.git (main)

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v2 Latest2 patches 2 repliesApplied 2/2
  2. v12 patches 6 repliesSuperseded

Patches in v2 All 2 applied

#Subject and filesSizeRepliesApplied
1/2netfilter: skip recording stale or retransmitted INITnet/netfilter/nf_conntrack_proto_sctp.c+7 -30 repliesApplied
2/2sctp: discard stale INIT after handshake completionnet/sctp/sm_statefuns.c+6 -00 repliesApplied

Reviews trailers per patch

All 2 patches have a Reviewed-by or Acked-by.

PatchMarcelo Ricardo LeitnerFlorian Westphal
1/2R-b A-b
2/2A-b

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v2 thread

Cover letter [PATCH net v2 0/2] sctp: fix a vtag verification failure caused by stale INITs

Similar to Scenario B in commit 8e56b063c865 ( netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp"):

Scenario B: INIT_ACK is delayed until the peer completes its own handshake

192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408]

    192.168.1.1 > 192.168.1.2: sctp (1) [INIT] [init tag: 144230885]
    192.168.1.2 > 192.168.1.1: sctp (1) [INIT ACK] [init tag: 3922216408]
    192.168.1.1 > 192.168.1.2: sctp (1) [COOKIE ECHO]
    192.168.1.2 > 192.168.1.1: sctp (1) [COOKIE ACK]

192.168.1.1 > 192.168.1.2: sctp (1) [INIT ACK] [init tag: 3914796021] *

There is another case:

Scenario F: INIT is delayed until the peer completes its own handshake

192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408] (OVS upcall)

    192.168.1.1 > 192.168.1.2: sctp (1) [INIT] [init tag: 144230885]
    192.168.1.2 > 192.168.1.1: sctp (1) [INIT ACK] [init tag: 3922216408]
    192.168.1.1 > 192.168.1.2: sctp (1) [COOKIE ECHO]
    192.168.1.2 > 192.168.1.1: sctp (1) [COOKIE ACK]

192.168.1.2 > 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408] (delayed)
192.168.1.1 > 192.168.1.2: sctp (1) [INIT ACK] [init tag: 3914796021] *

In this case, the delayed INIT (e.g. due to OVS upcall) is recorded by conntrack, which prevents vtag verification from dropping the unexpected INIT-ACK in nf_conntrack_sctp_packet():

  vtag = ct->proto.sctp.vtag[!dir];
  if (!ct->proto.sctp.init[!dir] && vtag && vtag != ih->init_tag)
          goto out_unlock;

This happens because ct->proto.sctp.init[!dir] is set by the delayed INIT, even though it is stale.

Fix this in two parts:

- In netfilter: Do not record INITs whose init_tag matches the peer vtag, as they carry no new handshake state in the 1st patch.

- In SCTP: Prevent endpoints from responding to such INITs with INIT-ACK, ensuring correctness even when middleboxes lack the netfilter fix in the 2nd patch.

A follow-up selftest for this scenario will be posted in a separate patch by Yi Chen.

Xin Long (2):
netfilter: skip recording stale or retransmitted INIT
sctp: discard stale INIT after handshake completion

 net/netfilter/nf_conntrack_proto_sctp.c | 10 +++++++---
 net/sctp/sm_statefuns.c                 |  6 ++++++
 2 files changed, 13 insertions(+), 3 deletions(-)
Signature · 1 line
2.47.1

Read the cover letter in its thread